General
-
Target
5BCC20FDF7090CA1F2CA66AB752D0965478666DC2952C435A3A4490423DAC47F
-
Size
213KB
-
Sample
221116-zadp5scg76
-
MD5
416d3ee7adcc100a046619a61ef6cf87
-
SHA1
91e05fe0a059b29b0f6fc75971dbfd8769bf3a98
-
SHA256
5bcc20fdf7090ca1f2ca66ab752d0965478666dc2952c435a3a4490423dac47f
-
SHA512
7f034ecd17ea2246eede0faf2b46a6b04078b133420063b1a8a3f0a783e22a0a1e1eec2d42ea43c25eba5db85f4771e57e65e6b330f4881f51df3f978f88ae92
-
SSDEEP
6144:lO+bydbpklHOa6y7OV+CmpGXw2Ow7As2CYaa/EpDJfzD:lX+deJBukCmpG+wksYaaspD9
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
Targets
-
-
Target
jetsoff887453.exe
-
Size
226KB
-
MD5
1eea2dfdae7eb894956ca1c1640f68c5
-
SHA1
d84785baefe3f1fce5bbd9cf93c03bb09d8a20e8
-
SHA256
45b23c325946154b6990adf193926f99019ccc14f815a9768c208494197d3208
-
SHA512
64efce3783fd512b03cff3e3c3b93bda7ddf793f199e64809a13c64b948e91deb68dddb1394e5a24353ab42012df88e4a7f0a213b29e9ae3f006bff19755572d
-
SSDEEP
6144:MEa0NOhe6ib7DKeu/cIJyJJnJCDTRn5lAAfh:XONibPeOJnJY9Dh
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-